🚨 Convict has prototype pollution via load(), loadFile(), and schema initialization

Impact

Two unguarded prototype pollution paths exist, not covered by previous fixes:

1. config.load() / config.loadFile() — overlay() recursively merges config data without checking for forbidden keys. Input containing __proto__ or constructor.prototype (e.g. from a JSON file) causes the recursion to reach Object.prototype and write attacker-controlled values onto it.
2. Schema initialization — passing a schema with constructor.prototype.* keys to convict({...}) causes default-value propagation to write directly to Object.prototype at startup.

Depending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.

Workarounds

Do not pass untrusted data to load(), loadFile(), or convict().

Resources

Prior advisory: GHSA-44fc-8fm5-q62h
Related issue: #423

🚨 Convict has Prototype Pollution via startsWith() function

Summary

A prototype pollution vulnerability exists in the latest version of the convict npm package (6.2.4). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype.

Details

The vulnerability resides in line 564 of https://github.com/mozilla/node-convict/blob/master/packages/convict/src/main.js where startsWith() function is used to check whether user provided input contain forbidden strings.

PoC

Steps to reproduce

1. Install latest version of convict using npm install or cloning from git
2. Run the following code snippet:

String.prototype.startsWith = () => false; 
const convict = require('convict');
let obj = {};
const config = convict(obj);
console.log({}.polluted);
config.set('constructor.prototype.polluted', 'yes');
console.log({}.polluted);    // prints yes -> the patch is bypassed and prototype pollution occurred

Expected behavior

Prototype pollution should be prevented and {} should not gain new properties.
This should be printed on the console:

undefined
undefined OR throw an Error

Actual behavior

Object.prototype is polluted
This is printed on the console:

undefined 
yes

Impact

This is a prototype pollution vulnerability, which can have severe security implications depending on how convict is used by downstream applications. Any application that processes attacker-controlled input using convict.set may be affected.
It could potentially lead to the following problems:

1. Authentication bypass
2. Denial of service
3. Remote code execution (if polluted property is passed to sinks like eval or child_process)

6.2.5 (from changelog)

Bug Fixes

• Consistent use of quotes in output (#405) (de1629a)
• prevent prototype pollution bypass via String.prototype.startsWith override (d9a5491)
• prevent prototype pollution via load() and loadFile() (3d7d836)
• prevent prototype pollution via schema initialization (d251c47)

Does any of this look wrong? Please let us know.

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)